Monthly
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-model helper script resolution. When workspace-controlled files shadow the intended helper script, any subsequent local skill execution loads the attacker-placed file instead, running arbitrary code under the victim user's context. No KEV listing or public exploit has been identified, but the low-complexity local attack vector makes this a credible risk in shared or CI-driven development environments.
Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.
Untrusted Search Path exploitation in Adobe Substance 3D Painter allows an attacker to achieve arbitrary code execution under the current user's account by planting a malicious DLL or executable alongside a crafted project file. The root cause (CWE-426) is the application's failure to validate the library search path when loading dependencies at runtime, enabling full compromise of confidentiality, integrity, and availability on the victim host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity, well-understood exploitation technique, and complete C/H/I/A/A impact triad make this a meaningful patching priority for teams whose users open externally sourced project files.
Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.
Privilege escalation in the OnGres StackGres operator lets a low-privilege, database-owning tenant elevate to administrator privileges, breaking the multi-tenant isolation model of this Kubernetes-based PostgreSQL platform. The CVSS 9.9 rating with a scope change (S:C) reflects that an authenticated tenant confined to their own database can cross a trust boundary to gain full administrative control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the only public reference is a GitLab work item tracking the flaw.
Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.
Local arbitrary code execution in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 stems from improperly scrubbed environment variables (CWE-426: Untrusted Search Path), allowing a low-privileged local user to inject malicious values such as PATH or LD_PRELOAD that are subsequently consumed by a privileged process. With a CVSS score of 7.8 (HIGH) and full confidentiality, integrity, and availability impact, successful exploitation yields arbitrary code execution at an elevated privilege level. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM support.
Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from its Whirlpool hash routine loading .so extension modules via a broad glob pattern without any integrity check. An attacker who can drop a file matching 'whirlpool*py313*.so' into a site-packages directory gets their code executed in-process the moment the hashing module is imported. Reported by VulnCheck; a vendor patch (1.4.0) exists, and there is no public exploit identified at time of analysis.
Remote code execution in IBM i 7.3 through 7.6 is possible for any authenticated remote attacker who can manipulate an untrusted search path used by privileged system components. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network accessibility with minimal privilege prerequisites and no user interaction, yielding full confidentiality, integrity, and availability impact. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary code execution in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 on Windows is enabled by a publicly writable directory created when the application is installed in 'all users' mode. A local attacker with low privileges can plant malicious content in this directory, which the application subsequently loads with higher-privilege context, achieving full code execution. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.11% (2nd percentile) reflects low observed exploitation pressure, though the SSVC technical impact rating is 'total', underscoring the severity if exploited.
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-model helper script resolution. When workspace-controlled files shadow the intended helper script, any subsequent local skill execution loads the attacker-placed file instead, running arbitrary code under the victim user's context. No KEV listing or public exploit has been identified, but the low-complexity local attack vector makes this a credible risk in shared or CI-driven development environments.
Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.
Untrusted Search Path exploitation in Adobe Substance 3D Painter allows an attacker to achieve arbitrary code execution under the current user's account by planting a malicious DLL or executable alongside a crafted project file. The root cause (CWE-426) is the application's failure to validate the library search path when loading dependencies at runtime, enabling full compromise of confidentiality, integrity, and availability on the victim host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity, well-understood exploitation technique, and complete C/H/I/A/A impact triad make this a meaningful patching priority for teams whose users open externally sourced project files.
Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.
Privilege escalation in the OnGres StackGres operator lets a low-privilege, database-owning tenant elevate to administrator privileges, breaking the multi-tenant isolation model of this Kubernetes-based PostgreSQL platform. The CVSS 9.9 rating with a scope change (S:C) reflects that an authenticated tenant confined to their own database can cross a trust boundary to gain full administrative control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the only public reference is a GitLab work item tracking the flaw.
Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.
Local arbitrary code execution in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 stems from improperly scrubbed environment variables (CWE-426: Untrusted Search Path), allowing a low-privileged local user to inject malicious values such as PATH or LD_PRELOAD that are subsequently consumed by a privileged process. With a CVSS score of 7.8 (HIGH) and full confidentiality, integrity, and availability impact, successful exploitation yields arbitrary code execution at an elevated privilege level. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM support.
Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from its Whirlpool hash routine loading .so extension modules via a broad glob pattern without any integrity check. An attacker who can drop a file matching 'whirlpool*py313*.so' into a site-packages directory gets their code executed in-process the moment the hashing module is imported. Reported by VulnCheck; a vendor patch (1.4.0) exists, and there is no public exploit identified at time of analysis.
Remote code execution in IBM i 7.3 through 7.6 is possible for any authenticated remote attacker who can manipulate an untrusted search path used by privileged system components. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network accessibility with minimal privilege prerequisites and no user interaction, yielding full confidentiality, integrity, and availability impact. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary code execution in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 on Windows is enabled by a publicly writable directory created when the application is installed in 'all users' mode. A local attacker with low privileges can plant malicious content in this directory, which the application subsequently loads with higher-privilege context, achieving full code execution. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.11% (2nd percentile) reflects low observed exploitation pressure, though the SSVC technical impact rating is 'total', underscoring the severity if exploited.